CoreCVE
Back

MEDIUM

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element

Published Apr 25, 2014

Description

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-264

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 25, 2014
Updated Aug 6, 2024
Reserved Aug 9, 2012
Link CVE-2012-4230
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2012-4230
Red Hat
Severity n/a
Public date n/a
Links CVE-2012-4230